CVE-2026-6454 is a stored DOM XSS vulnerability in the Firelight Lightbox WordPress plugin (up to version 2.3.20). The issue arises from insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback in inc/fancybox-2.php. Specifically, this.href is concatenated directly into an HTML string without escaping, enabling stored href values containing entity-encoded double-quotes to break out of the data attribute context and inject arbitrary event handlers into the DOM. Authenticated users with contributor-level privileges or higher can exploit this to inject malicious scripts that execute when users click the malicious PDF link.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via crafted PDF links. These scripts execute in the context of users who click the links, potentially leading to unauthorized actions or data exposure limited to the scope of the injected scripts. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Firelight Lightbox plugin if not essential. Monitor official vendor channels for updates or patches addressing this vulnerability.